Overview

overview

10

Static

static

8

document-1...24.xls

windows7_x64

10

document-1...24.xls

windows10_x64

1

Sharing

Copy URL
Twitter E-mail

General

  • Target

    document-1489515124.xls

  • Size

    331KB

  • Sample

    201126-axf2z4a92n

  • MD5

    fec5865c4a375d755799e97103fa321b

  • SHA1

    f08ee6224a7462c2dd431318dcb276b748d217c2

  • SHA256

    ea683ddc31ea4fc406546063e4bc97a1f080f598898cbf556b897d4e61ca229a

  • SHA512

    4ea590bc20591b4993452f5451c4697bc43ae6f27fb3caeaab6a47e9952c09efb5a5b12efb42d4abdb73e95fd072ad323c0aaf261936843d407ba00c478d4755

Score
10/10
macro

Malware Config

Targets

    • Target

      document-1489515124.xls

    • Size

      331KB

    • MD5

      fec5865c4a375d755799e97103fa321b

    • SHA1

      f08ee6224a7462c2dd431318dcb276b748d217c2

    • SHA256

      ea683ddc31ea4fc406546063e4bc97a1f080f598898cbf556b897d4e61ca229a

    • SHA512

      4ea590bc20591b4993452f5451c4697bc43ae6f27fb3caeaab6a47e9952c09efb5a5b12efb42d4abdb73e95fd072ad323c0aaf261936843d407ba00c478d4755

    Score
    10/10

    • Process spawned unexpected child process

      This typically indicates the parent process was compromised via an exploit or macro.

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

1
T1112

Credential Access

Discovery

Query Registry

1
T1012

System Information Discovery

1
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks